Security Vulnerabilities in HikCentral Product Series
SN No. HSRC-202410-01
Edit: Hikvision Security Response Center (HSRC)
Initial Release Date: 2024-10-18
Summary
(1) There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.
(2) There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data.
(3) There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries.
CVE ID
CVE-2024-47485
CVE-2024-47486
CVE-2024-47487
Scoring
CVSS v4.0 is adopted in scoring these vulnerabilities
(http://www.first.org/cvss/v4.0/specification-document)
CVE-2024-47485
Base score: 5.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H)
CVE-2024-47486
Base score: 2.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)
CVE-2024-47487
Base score: 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L)
Affected Versions and Fix
Product Name |
CVE ID |
Affected Versions |
Fixed Version |
HikCentral Master Lite |
CVE-2024-47485 |
Versions between V2.0.0 and V2.2.1 |
V2.3.0 |
HikCentral Master Lite |
CVE-2024-47486 |
Versions below V2.2.1 (including V2.2.1) |
V2.3.0 |
HikCentral Professional |
CVE-2024-47487 |
Versions between V2.0.0 and V2.6.0 |
V2.6.1 |
Obtaining Fixed Version
Contact the local technical support team (click to select a country or region and check the detail technical service) to get the support.
Source of Vulnerability Information
These vulnerabilities were reported to HSRC by Yousef Alfuhaid and Manh Doan Duc.
Contact Us
To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hrbaojie.com.
Hikvision would like to thank all security researchers for your attention to our products.
hrbaojie.com uses strictly necessary cookies and related technologies to enable the website to function. With your consent, we would also like to use cookies to observe and analyse traffic levels and other metrics / show you targeted advertising / show you advertising on the basis of your location / tailor our website's content. For more information on cookie practices please refer to our cookie policy.
You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.
Core Technologies
Accessory Selector
Product Selector
HiTools Designer
Hikvision License Activation
Hikvision App Store
